From 5197fa80405a470eef7cd2540380172aea6d60af Mon Sep 17 00:00:00 2001 From: Alexey Borzenkov Date: Mon, 30 Jul 2012 09:02:24 +1000 Subject: [PATCH] syscall: workaround accept() bug on Darwin Darwin kernels have a bug in accept() where error result from an internal call is not checked and socket is accepted instead of ECONNABORTED error. However, such sockets have no sockaddr, which results in EAFNOSUPPORT error from anyToSockaddr, making Go http servers running on Mac OS X easily susceptible to denial of service from simple port scans with nmap. Fixes #3849. R=golang-dev, adg, mikioh.mikioh CC=golang-dev https://golang.org/cl/6456045 --- src/pkg/syscall/syscall_bsd.go | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/pkg/syscall/syscall_bsd.go b/src/pkg/syscall/syscall_bsd.go index 8269286daf..36fba9e06f 100644 --- a/src/pkg/syscall/syscall_bsd.go +++ b/src/pkg/syscall/syscall_bsd.go @@ -303,6 +303,14 @@ func Accept(fd int) (nfd int, sa Sockaddr, err error) { if err != nil { return } + if len == 0 { + // Accepted socket has no address. + // This is likely due to a bug in xnu kernels, + // where instead of ECONNABORTED error socket + // is accepted, but has no address. + Close(nfd) + return 0, nil, ECONNABORTED + } sa, err = anyToSockaddr(&rsa) if err != nil { Close(nfd) -- 2.48.1